1. Who we are

This privacy policy explains how The Glitch Collective Ltd. (“TGC”, “we”, “us”) handles personal data in Kaiko, the software we run as our bookkeeper. TGC is the controller of that data.

Company number 11078723, VAT registration GB431493505
Registered address Unit 26A, Grow Studios, 86b Wallis Road, Hackney Wick, London E9 5LN, UK
Email contact@theglitch.co, subject line “Kaiko”

We are not required to appoint a data protection officer. This policy sits beside the privacy policy for our websites and services, which covers everything else we do.

2. What Kaiko is

Kaiko reads the receipts and invoices the company receives, extracts the figures, proposes how each should be recorded, matches bank transactions to documents, and, when a person has allowed it, creates expense entries in the company’s QuickBooks Online accounts with the document attached. It prepares the figures for VAT returns, which a person submits. Kaiko runs on the company’s own computers in its office in London: the documents are read and sorted there, and nothing leaves the office except what QuickBooks Online needs, through Intuit’s authorised interface.

3. Whose data, and what data

People who use Kaiko (our directors, staff, contractors and accountant): your name or initials, your login, what you approved, held or corrected and when, and the scores the review page keeps for each sitting.

People named in the company’s accounting documents: suppliers, customers, contractors, crew, members and staff claiming expenses. From receipts, invoices, statements and bank transactions we hold what those documents contain: names, business and sometimes home addresses, email addresses and phone numbers, bank account details and VAT numbers as printed on invoices, what was bought or sold, amounts, dates, references, and sometimes a vehicle registration or travel details on a fuel, parking or ticket receipt. We also hold the project or job the transaction belongs to.

Where it comes from: the documents themselves, which reach the company by post, by download, as photographs taken in the office, or by email to the company’s own mailboxes, which Kaiko reads for receipts and invoices and nothing else; the company’s QuickBooks Online accounts, including entries made by our accountants; the bank transactions the company’s bank supplies to QuickBooks; and the company’s own project records and calendar, which tell Kaiko which job a document belongs to.

4. Why we process it, and on what legal basis

Keeping the company’s accounting and VAT records — a legal obligation under the Companies Act 2006 and the Value Added Tax Act 1994 and regulations made under them.
Paying suppliers and being paid by customers — necessary to perform contracts with them, and for the steps needed before a contract.
Keeping the books accurate, complete and economical to run, and checking them — our legitimate interest in running the company’s finances properly. We have weighed this against the interests of the people concerned: the data is business transaction data of the kind any accounts department handles, it is used for nothing else, and the people concerned would expect it.
The review page’s record of who approved what, and its scores — our legitimate interest in an accountable, traceable bookkeeping process; the scores are part of how the work is done and use initials only.

Nobody is required by law or contract to give us data through Kaiko, except that suppliers’ invoices must by law contain certain details for VAT.

5. Automation and the seventy-thirty rule

Kaiko is an agent: software that works on its own within limits we set. It reads documents with optical character recognition and a set of rules written by us, settles what a document proves and asks a person about the rest. All of that happens on the company’s own hardware in the office; no document leaves the office to be read, and no data handled by Kaiko is used to train anything.

The work is split seventy to thirty. Kaiko does the routine seventy: reading, extracting, matching, proposing, filing what a document proves, and keeping the evidence. People hold the thirty that matters: every decision with legal, tax or financial effect, including approving anything Kaiko could not prove, submitting returns, paying, and correcting or reversing what Kaiko filed. Everything Kaiko files shows why, and a person can reverse it with one action.

We do not take any decision about an individual solely by automated means that has a legal or similarly significant effect on them (Articles 22A to 22D of the UK GDPR). Kaiko records transactions; it does not decide whether to deal with you, what to pay you, or what you owe. If you believe something Kaiko did affects you, you may ask us for a person to look at it, make representations, and contest it: see section 10.

6. Who receives the data

Intuit Inc. — QuickBooks Online, where the company’s accounts are kept. Intuit processes the data as our processor under its terms and may store it in the United States. Intuit’s own privacy statement applies to its service.
Our external accountant — who prepares the company’s annual accounts and tax returns and reviews the books.
HM Revenue & Customs — the figures in VAT returns and the accounts and tax returns the law requires, submitted by a person or by our accountant, never by Kaiko.
The company’s bank — already holds the transactions it supplies to QuickBooks; nothing goes back to it from Kaiko.
The providers that store the company’s files and host the tools the office works with — under written contracts that allow them to act only on our instructions.

Kaiko’s review page and files are on a computer and a small server inside the company’s office in London, reachable only from the office network. We do not sell or rent personal data, and we do not share it with anyone else unless the law requires it.

7. Transfers outside the United Kingdom

Where a provider above stores data outside the United Kingdom, we rely on the UK Extension to the EU-US Data Privacy Framework (the UK-US data bridge) where the recipient is certified under it, and otherwise on the UK International Data Transfer Addendum to the European Commission’s standard contractual clauses. You may ask us for a copy of the safeguards that apply.

8. How long we keep it

Accounting documents, the figures Kaiko extracted from them, and the entries made in QuickBooks — at least six years from the end of the financial year they relate to, as HM Revenue & Customs requires, and longer while any enquiry, audit or dispute about that year is open.
Kaiko’s working copies (images of documents, extracted text, the record of what was filed and why) — for the same period as the documents they come from, then deleted.
Kaiko’s keys to QuickBooks — until Kaiko is disconnected, or until Intuit retires them after 100 days without use; then revoked and deleted.
Your login and the review page’s record of your sittings — while you are an authorised user, and removed when your access ends, except where the record of who approved an entry forms part of the accounting records above.

9. Security

The review page is reachable only inside the office network and behind a password. Kaiko’s keys to QuickBooks are kept in a file on one computer that only the office’s own user can read, and they can be revoked at any moment from QuickBooks or from that computer; its access to the company’s mailboxes is read-only and its credentials for them live in that computer’s keychain. Kaiko reads by default; it writes to QuickBooks only in a session a person has deliberately started, and it never deletes or rewrites existing entries. Every entry Kaiko files shows its evidence and is reversible by a person, and Kaiko keeps a record of every change it makes. Data in transit to Intuit is encrypted.

10. Your rights

Under the UK GDPR you may ask us to:

give you access to the personal data we hold about you, and a copy of it;
correct data that is wrong or incomplete;
erase data, except where we must keep it as an accounting record;
restrict how we use it while a question about it is resolved;
stop processing based on our legitimate interests, where your situation gives you grounds to object (and we must then stop unless we can show compelling grounds);
give you your data in a portable form where we process it by automated means on the basis of a contract;
and, for any automated processing that affects you, tell you about it, hear your representations, have a person intervene, and let you contest the outcome.

Email contact@theglitch.co with the subject line “Data request – Kaiko”. We may ask you to confirm who you are. We respond within one month; for complex or multiple requests we may take up to two months more and will tell you if so. There is no charge unless a request is manifestly unfounded or excessive.

11. Complaints

If you think we have handled your personal data wrongly, please complain to us first at contact@theglitch.co, subject line “Data protection complaint”. We acknowledge every complaint within 30 days, look into it without undue delay, and tell you the outcome. You also have the right to complain to the Information Commissioner’s Office: ico.org.uk, telephone 0303 123 1113, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF.

12. Children

Kaiko is a work tool for adults. We do not knowingly process children’s data through it, except where a child’s name appears on a document the company has received in the course of its business.

13. Changes

We may update this policy. The date at the top shows the latest revision, and we tell authorised users about material changes.

14. Contact

The Glitch Collective Ltd. Unit 26A, Grow Studios, 86b Wallis Road, Hackney Wick, London E9 5LN, UK. Email: contact@theglitch.co, subject line “Kaiko”.